The framework · Index

The Essential Eight, control by control

The Essential Eight (often written Essential 8) is the Australian Signals Directorate's baseline of eight mitigation strategies, each assessed at maturity Levels 0–3. Below is one plain-English explainer per control: what it means for a small business, what each level asks of you, and why brokers and insurers keep bringing it up.

01 / 08

Application control

Application control means your computers only run software the business has approved. Most security tools try to catch bad software. This one works the other way round: if a program is not on the approved list, it does not run. It is one of the most effective defences against ransomware and malicious downloads.

Read the explainer

02 / 08

Patch applications

Patching applications means installing security fixes for your everyday software (browsers, office suites, email clients, PDF readers, antivirus) soon after vendors release them. Attackers go after known flaws in out-of-date software, often within days of a fix coming out. Under the Essential 8 (Essential Eight), the bar rises with each maturity level. A set patch timeframe, sometimes called application patch management, replaces the "patch it when we remember" habit.

Read the explainer

03 / 08

Restrict Microsoft Office macros

Microsoft Office macros are small programs tucked inside documents and spreadsheets. They are also a favourite way to deliver malware: a booby-trapped invoice or résumé that runs code the moment someone clicks "enable". This control limits which macros can run, especially in files that came from the internet.

Read the explainer

04 / 08

User application hardening

User application hardening means switching off the risky features in everyday software that attackers abuse: browsers running Java or ads from the internet, Office launching other programs, old tools like Internet Explorer 11. Most businesses never use these features. Turning them off costs little and closes real attack paths.

Read the explainer

05 / 08

Restrict administrative privileges

Administrative (admin) accounts can install software and change security settings, which is exactly why attackers hunt for them first. This control keeps admin rights to the few people who need them, keeps admin accounts separate from everyday ones, and makes sure privileged access is reviewed and logged.

Read the explainer

06 / 08

Patch operating systems

Patching operating systems, often just called OS patches, means keeping Windows, macOS and the firmware on servers, firewalls and routers up to date with security fixes. It also means replacing systems so old they no longer get updates. Internet-facing devices matter most, because attackers can probe them directly.

Read the explainer

07 / 08

Multi-factor authentication

Multi-factor authentication (MFA) adds a second step when you sign in (a code from an app, a security key or a fingerprint), so a stolen password on its own is not enough. Insurers ask about it more than any other control, because it stops the most common attack there is: someone signing in with a password phished from your staff.

Read the explainer

08 / 08

Regular backups

Regular backups protect the data your business runs on, but only if the backups themselves are protected from tampering and actually tested. A backup that ransomware can encrypt, or one you have never restored, gives false comfort. This control covers how often you back up, how those backups are protected, and whether restoring them has been tested. The Essential 8 does not set one fixed schedule, such as daily backups, for every business; instead it ties backup frequency to how critical the data is and your business continuity needs, so a daily job for one system and a weekly job for a less critical one can both meet it.

Read the explainer

Check your maturity across all eight, free